Tools · Smaller checks

Is this proof enough?

For a security leader finding out what an inherited programme really does. Choose what you were shown for one claim, and see the finding it supports, what to do next and what proof to ask for. Free, no account, and nothing is stored.

Think of one claim: something you were told, or a document says, about the programme you inherited. Choose what you were shown for it. Nothing you choose is kept.

Question 1 · OptionalWhich area is the claim about?

The area decides what proof to ask for next, from the workbook's Areas sheet.

Area

Question 2What were you shown for it?

Choose the strongest thing you saw yourself. If what you saw differs from the claim, choose the last.

A recordA document or a file you read, that matches the claim A testSomething you did or checked yourself, on a sample, that bears it out A view of the systemWhat the system showed you, on screen, with its dates, that matches Only a statementYou were told, or a document claims it, and nothing shows it is done NothingYou asked, and nothing was produced Something that contradicts itWhat you saw differs from what you were told or what the document says

The finding

Choose what you were shown, and the finding word appears here.

The check needs JavaScript

Without it, read the four finding words and the rule below: what you saw yourself, a record, a test or a view of the system, is the line between Evidenced and Described only.

Record the finding in the workbook, not here. This page has no place for the claim or what you saw, and keeps nothing you choose. TheInherited Security Programme Discovery Workbook holds each finding with what you saw and when.

The four finding words

A finding is one of these, with what was seen. A blank row reads Not yet looked at. It is not a finding.

Evidenced: A record, a test result or a system view that you saw matches what you were told or what the document says.
Described only: You were told, or a document claims it, and you have seen nothing that shows it is done.
Not found: You asked for it, by a date, and nothing was produced and nothing could be found.
Contradicted: What you saw differs from what you were told or what the document says.

How this works, and what it is not

The finding follows from what you were shown, by the workbook's rule:

TR-02. Every discovery finding states what was seen: a record, a test result or a system view. A statement alone is Described only. A finding is checked again after 6 months, or on a material change.

A record, a test or a view of the system that matches the claim is Evidenced. A statement, from a person or a document, is Described only. Nothing produced, once you asked by a date and the date passed, is Not found; before then the item is not yet looked at. What you saw that differs from the claim is Contradicted. A Record is a document or a file you read. A Test is something you do or check yourself, on a sample. A System view is what the system shows you, on screen, with its dates.

What it is not

Not a record. It keeps no claim, no finding and no date. The workbook holds each finding with what you saw, when you looked and the follow-up.
Not a maturity level. Evidenced is at least Seen in P19's words, and Described only is Told. A finding is not a maturity level. A level is set by P19's rules, from a sample of records.
Not a judgement of the proof's quality. It takes your word that what you saw matches the claim. A sample too small, or a record that covers only part of the claim, is for you to weigh.

Rule and words from: Inherited Security Programme Discovery Workbook, version 1.0
Runs: In your browser. Nothing is sent or stored